Buhtrap Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (129)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	98
de	14
ru	14
es	2
zh	2

Country

ru	118
us	8
ag	2
ga	2

Actors

Buhtrap	4
Gamaredon	2
Shuckworm	1
Redaman	1
AsyncRAT	1

Activities

Interest

Timeline

Type

Not Defined	42
E-Commerce Management Software	8
Operating System	8
Virtualization Software	6
Content Management System	6

Vendor

Not Defined	44
Microsoft	14
Linux Foundation	4
Apple	4
HP	4

Product

Microsoft Windows	6
Calibre-Web	4
Linux Foundation Xen	4
DEXIS Imaging Suite	2
ASN1C	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Siemens SIMATIC HMI United Comfort Panel authentication bypass	7.5	7.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00874	CVE-2020-15787
2	Microsoft Windows Advanced Local Procedure Call Privilege Escalation	9.2	8.7	$25k-$100k	$5k-$25k	Functional	Official Fix	0.03	0.00651	CVE-2023-21674
3	Microsoft Windows Kernel Privilege Escalation	7.2	6.5	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.05	0.00053	CVE-2022-21881
4	Microsoft Windows SMB Witness Service privileges management	8.8	8.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00	0.00120	CVE-2023-21549
5	Microsoft SQL Server Privilege Escalation	8.1	7.4	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.04	0.00043	CVE-2022-23276
6	Select2 cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00094	CVE-2016-10744
7	HP 3PAR Service Processor SP information disclosure	4.3	4.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.02	0.00110	CVE-2015-5443
8	Oracle Java SE/Java SE Embedded Deployment memory corruption	10.0	9.5	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.02	0.01195	CVE-2013-5788
9	WooCommerce PayU India Payment Gateway Plugin Purchase Price input validation	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00114	CVE-2019-14978
10	WooCommerce Instamojo Payment Gateway Plugin Purchase amount Price input validation	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00241	CVE-2019-14977
11	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.00548	CVE-2017-0055
12	Apache HTTP Server smbvalid/smbval authensmb memory corruption	10.0	9.5	$25k-$100k	Calculating	Not Defined	Official Fix	0.02	0.00133	CVE-1999-1237
13	Netgate pfSense XML File config.xml restore_rrddata command injection	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01	0.45928	CVE-2023-27253
14	Joomla Webservice Endpoint access control	5.4	5.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.03	0.95214	CVE-2023-23752
15	Lars Ellingsen Guestserver guestbook.cgi cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00169	CVE-2005-4222
16	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.50	0.01302	CVE-2007-0354
17	Cloudflare WARP Client warp-cli Subcommand access control	7.7	7.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00044	CVE-2022-2225
18	Siemens SIMATIC PCS 7/SIMATIC S7-PM/SIMATIC STEP 7 V5 code injection	9.2	9.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00084	CVE-2023-25910
19	Next.js next.config.js clickjacking	5.1	5.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00118	CVE-2022-23646
20	Linux Kernel memory corruption	5.9	5.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00042	CVE-2011-1477

IOC - Indicator of Compromise (11)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.63.159.32	5-63-159-32.cloudvps.regruhosting.ru	Buhtrap	12/23/2020	verified	High
2	37.140.195.165	console.teonet.cloud	Buhtrap	12/23/2020	verified	High
3	37.143.12.190	hosted-by.ihc.ru	Buhtrap	12/23/2020	verified	High
4	XX.XXX.XXX.XX		Xxxxxxx	03/25/2019	verified	High
5	XXX.XXX.XXX.XXX	xxxx.xxxxxxxxx.xxxxx	Xxxxxxx	12/23/2020	verified	High
6	XXX.XX.XX.XX	xxx-xx-xx-xx.xxx.xxx.xxxxxxxxxxxx.xx	Xxxxxxx	12/23/2020	verified	High
7	XXX.XXX.XX.XXX	xxxxxx.xxx.xxxxxxxxx.xx	Xxxxxxx	12/23/2020	verified	High
8	XXX.XX.XX.XXX	xxxxxxxxx.xx	Xxxxxxx	12/23/2020	verified	High
9	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxx.xxx.xxxxxxxxxxxx.xx	Xxxxxxx	12/23/2020	verified	High
10	XXX.XXX.XXX.XXX		Xxxxxxx	12/23/2020	verified	High
11	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxxxx.xxx	Xxxxxxx	03/25/2019	verified	High

TTP - Tactics, Techniques, Procedures (17)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22	Path Traversal	predictive	High
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CWE-94	Argument Injection	predictive	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
11	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
12	TXXXX	CWE-XXX	Xxx Xx Xxxxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
13	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
14	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx	predictive	High
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
16	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
17	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (80)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/objects/getImageMP4.php	predictive	High
2	File	/payu/icpcheckout/	predictive	High
3	File	/uncpath/	predictive	Medium
4	File	adclick.php	predictive	Medium
5	File	admin.php	predictive	Medium
6	File	adrotate.pm	predictive	Medium
7	File	article.php	predictive	Medium
8	File	asn1fix_retrieve.c	predictive	High
9	File	bigsam_guestbook.php	predictive	High
10	File	xxxxx.xxx	predictive	Medium
11	File	xxxx/xxx/.../xxxxxx	predictive	High
12	File	xxxxxxxx.xxx	predictive	Medium
13	File	xxxxx.xxx	predictive	Medium
14	File	xxxxxx.xxx	predictive	Medium
15	File	xxxxxxx.xxxx	predictive	Medium
16	File	xxxxxx.xxx	predictive	Medium
17	File	xx/xx_xxxxxxx.xxx	predictive	High
18	File	xxxxxxxx.xxx	predictive	Medium
19	File	xxxxxxx/xxxx/xxxxxx/xxxxxxx.x	predictive	High
20	File	xxxxx.xxx	predictive	Medium
21	File	xxxxxxxxx/xxxxx/xxxxxxxxxxxx/xxxxxxxxx.xxx	predictive	High
22	File	xxxxxxx.xxx	predictive	Medium
23	File	xxxxxxxxx.xxx	predictive	High
24	File	xxx/xxxxxx.xxx	predictive	High
25	File	xxxxx.xxx/xxxxxx.xxx/xxxxxxxxxxxxx.xxx/xxxxxxxx.xxx	predictive	High
26	File	xxxxxxx/xxxxxxxxxxxxx.xxxx	predictive	High
27	File	xxxx_xxxx.xxx	predictive	High
28	File	xxxxxxxx.xxx	predictive	Medium
29	File	xxx/xxxx/xxxx_xxxx.x	predictive	High
30	File	xxxx.xxxxxx.xx	predictive	High
31	File	xxx/xxxxx.xxxx	predictive	High
32	File	xxxxxxx.xxx	predictive	Medium
33	File	xxxx.xxx	predictive	Medium
34	File	xxxxxxx.xxx	predictive	Medium
35	File	xxxx-xx.xxx/xxx.xxxxx/xxx-xxxxxxxx-xxxx.xxx	predictive	High
36	File	xxxx_xxxxxxx_xxxxxxxx.xxx	predictive	High
37	File	xxx/xxxx/xxxx/xxx.xxxxxxxx.xxxxxxx/xxxxxxx/xxx/xxxxxx.xxxx	predictive	High
38	File	xxxxxxx-xxxxxxx.xxx	predictive	High
39	File	xx/xx/xxxxxxxxx_xxxxxxxxxxx.xxx	predictive	High
40	File	xxxx.xxx	predictive	Medium
41	File	xxxx/xxxxxxxxxxxx.xxx	predictive	High
42	File	xxxxxxxxxxxx.xxx	predictive	High
43	File	xxx.xxxxxxxx.xxx	predictive	High
44	File	xxxxxxxx.xxx	predictive	Medium
45	File	_xxxxxxxxx_xxxxxx_xxxxx___.xxx	predictive	High
46	Library	xxxxxx.xxx	predictive	Medium
47	Library	xxxxxxxx.xxx.xxx	predictive	High
48	Argument	xxxxxxxxx	predictive	Medium
49	Argument	xxxxxxxx	predictive	Medium
50	Argument	xxxxxx	predictive	Low
51	Argument	xxx_xxx	predictive	Low
52	Argument	xxx	predictive	Low
53	Argument	xxx_xx	predictive	Low
54	Argument	xxx	predictive	Low
55	Argument	xxxx_xx	predictive	Low
56	Argument	xxxxxxx	predictive	Low
57	Argument	xxxx	predictive	Low
58	Argument	xxxxxxxx	predictive	Medium
59	Argument	xxxxxxxxx->xxxxxxxxx	predictive	High
60	Argument	xx	predictive	Low
61	Argument	xxxx_xx	predictive	Low
62	Argument	xxx	predictive	Low
63	Argument	xx	predictive	Low
64	Argument	xxxxxxxxxxxxxxxx	predictive	High
65	Argument	xxxxxx/xxxxxx_xxxxxx	predictive	High
66	Argument	xxxxxx	predictive	Low
67	Argument	xxx	predictive	Low
68	Argument	xxxx	predictive	Low
69	Argument	xxxxxxx	predictive	Low
70	Argument	xxx	predictive	Low
71	Argument	xxxxx	predictive	Low
72	Argument	xxx	predictive	Low
73	Argument	xxxxxx	predictive	Low
74	Argument	xxxxxxxx	predictive	Medium
75	Argument	xxxxxxxx	predictive	Medium
76	Argument	xxxxxxxx/xxxx	predictive	High
77	Argument	xxxxxxxx:xxxxxxxx	predictive	High
78	Input Value	xxx[…]	predictive	Medium
79	Input Value	xxxxxxxxx:xxxxxxxx	predictive	High
80	Network Port	xxx	predictive	Low

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!